Fix config-not-found errors, dev-build hint, unify output writer

ResolveConfigPath now stats explicit paths from --config and
$VAULTIK_CONFIG and produces an actionable error naming the bad
path and suggesting 'vaultik config init' (with the right path
in the --config case). The default-search failure message lists
the paths it tried.

The scanner no longer hard-codes os.Stdout vs io.Discard based on
EnableProgress. ScannerConfig and ScannerParams take an explicit
Output io.Writer, and the Vaultik caller passes v.Stdout — which
itself is set to io.Discard in --cron mode. One knob controls
both scanner-level and Vaultik-level user-facing output.

The version command prints a hint when Version == "dev" telling
the user this is a development build without embedded version
metadata.

internal/cli/version.go

@@ -20,6 +20,12 @@ func NewVersionCommand() *cobra.Command {
 			fmt.Printf("  commit:  %s\n", globals.Commit)
 			fmt.Printf("  go:      %s\n", runtime.Version())
 			fmt.Printf("  os/arch: %s/%s\n", runtime.GOOS, runtime.GOARCH)
+			if globals.Version == "dev" {
+				fmt.Println()
+				fmt.Println("This is a development build (no version information embedded).")
+				fmt.Println("Build a release binary with 'make vaultik' or download from")
+				fmt.Println("https://sneak.berlin/go/vaultik for embedded version metadata.")
+			}
 		},
 	}